Kilo Privacy Policy

Version: 1.0
Effective date: 2026-08-17
Last updated: 2026-08-17

This Privacy Policy explains how Kilo Routes ("Kilo", "we", "us", or "our") handles personal data in connection with the Kilo platform and Services. It uses the same defined terms as our Terms of Service (for example, Customer, End User, Link, QR Code, Destination, Services, Door).

Plain-English summary (non-binding). This policy covers two different groups of people: (1) account holders (our customers, who create Links and QR Codes) and (2) End Users (people who scan or click those Links). For account data, Kilo is the "controller." For the click/scan data generated by a customer's Links, the customer is the controller and Kilo mostly acts as their "processor." A few honest highlights we're proud of: we never store raw IP addresses (we hash them with a rotating secret and throw the input away), we set no cookies on the redirect/QR domains at all, and our marketing sites use cookieless analytics. The grey summary boxes throughout are friendly explanations and are not the binding text.

Each numbered section below begins with a plain-English summary in a quote box. Those summaries are explanatory only and non-binding. Only the numbered provisions are binding.

1. Scope and the Two Audiences

In short. If you hold a Kilo account, this whole policy is about you. If you just scanned or clicked a Kilo Link, jump to Section 4 - and know that the person who made the Link, not Kilo, is usually the one who decides what happens with the data about your click.

1.1 This policy applies to personal data we handle when you interact with the Services, whether you are:

• (a) a Customer / account holder - an individual or a person acting for an organization that registers for or uses the Services to create and manage Links and QR Codes; or
• (b) an End User - a person who scans a QR Code, clicks or visits a Link, views a Kilo-hosted landing page or file, or otherwise interacts with Customer Content.

1.2 It also applies to visitors of our marketing sites and to people who contact us (support, abuse reports, sales).

1.3 It does not apply to the Destinations that Links point to, which are operated by third parties, nor to the internal practices of our Customers, who are responsible for their own privacy notices to their End Users.

2. Controller and Processor Roles

In short. Kilo is the controller (the decision-maker) for the data it collects to run its own business - your account, billing, security, and our own product analytics. But when a customer's Link records a scan or click, that customer is the controller of that click/scan data, and Kilo acts as their processor, handling it on their instructions. If you're an End User and want to know why a specific Link collected data about you, ask the person or business that owns that Link.

2.1 Kilo as controller. Kilo is the controller of personal data it collects and uses for its own purposes, including: account and Organization data; authentication and security data; billing and support data; our own product analytics about how account holders use the dashboard; and marketing-site analytics.

2.2 Kilo as processor for click/scan data. When an End User interacts with a Customer's Link or QR Code, the resulting click/scan analytics are generated on behalf of, and under the instructions of, the Customer, who is the controller of that data. For that data, Kilo acts as a processor and processes it to provide analytics and the redirect/QR service to the Customer. The Customer is responsible for having a lawful basis for that processing and for providing any required notice to its End Users.

2.3 End-User direction. If you are an End User and want to exercise rights over, or ask questions about, the data collected by a specific Link or QR Code, please contact the Customer that owns that Link (the business or person behind the Destination). We will reasonably assist our Customers in responding to such requests. You can also use our /verify page to learn limited trust information about a Link, and /abuse to report a Link.

2.4 vCard and landing-page content. Where a Customer creates a Link that displays contact details or other personal data (for example, a vCard, event, coupon, or review page), that content is Customer Content, and the Customer is its controller. Kilo hosts and serves it as a processor on the Customer's behalf.

3. Account-Holder Data We Collect (Kilo as Controller)

In short. When you sign up and use the dashboard, we store your email and Google account ID (not your name or profile picture), your organization and team info, security credentials as hashes, billing identifiers (never your card), your links and content, and support messages. We also record limited first-touch marketing attribution.

3.1 We collect the following categories of account-holder personal data:

• (a) Identity and login. Your email address and a Google account identifier obtained through Google sign-in. We request the openid email profile scopes, but we persist only your email and Google account ID - we do not store your name or profile picture.
• (b) Organization and team data. Organization name and settings, seat memberships and roles, invitations (invitee email, role, token), and workspace preferences.
• (c) Authentication and security data. Session tokens (a 7-day HttpOnly, Secure session cookie, qr2r_session), multi-factor settings and passkey/WebAuthn data (passkey public keys are stored verbatim and are not secret; recovery codes and email-change codes are stored only as SHA-256 hashes), and API keys (stored only as a SHA-256 hash with a short prefix and last-4 for display; the full key is shown once).
• (d) Customer Content. Your Links, Slugs, Destinations, typed-link data (including vCard contact details you enter), QR designs and uploaded logos (embedded in the design record), brand kits, campaigns, and uploaded files/PDFs.
• (e) Billing data. Your merchant-of-record customer identifiers, plan/entitlement records, and billing metadata. Card and payment-instrument data are handled by our payment providers and never reach Kilo.
• (f) Support, abuse, and communications data. Support tickets and their context (page URL, referrer, related Link, browser user agent, and a hashed reporter IP - never a raw IP), abuse reports you submit, and our email logs (recipient, sender, subject, template, body, delivery status). Inbound email metadata is stored, with the raw message kept in our file storage.
• (g) Onboarding and attribution. Optional onboarding survey answers (role, use case, source) and limited first-touch attribution (first UTM parameters, first referrer, first landing path, first click identifiers, first Door).
• (h) Audit and operational logs. Administrative and security audit records of actions taken in your Account.
• (i) Sharing records. When you share an analytics report, we store the recipient's email address and the share's parameters so the share can be delivered, authenticated, and revoked.

4. End-User (Scan / Click) Data We Process

In short. When someone scans or clicks a Link, we record analytics about the event - approximate location, device, browser, referrer, UTM tags, and so on - tied to a rotating, non-identifying fingerprint, not to a name or a stored IP. This is the data the Customer controls (Section 2.2). We set no cookies on the redirect/QR domains.

4.1 What we record per scan/click. For each scan or click, we write an analytics event that may include: the Slug; approximate geographic location derived from network data (country, region, city); device type, operating system, and browser; language; the referring host; UTM parameters (source, medium, campaign); an A/B variant identifier; the network/ASN organization; the serving datacenter; the resolved Destination URL; the rule/link type; a traffic-quality classification (for example, human vs. bot); a detected bot name (if any); an inbound sub-ID; response latency; and the local hour of the visit.

4.2 Geolocation source. Approximate location is derived from network-level signals provided by our infrastructure at request time, not from any stored IP address. It is approximate (often at the level of an IP block or carrier hub) and may be inaccurate.

4.3 No raw IP address is ever stored. (See Section 5 for the full explanation.)

4.4 Fingerprint, not identity. Events are indexed by a rotating fingerprint (Section 5), which is designed to enable basic de-duplication and counting without identifying the End User.

4.5 Bot filtering. We classify traffic and drop certain automated safety-scanner traffic before recording; most other traffic (including humans, crawlers, and automation) is recorded so that Customers get accurate analytics.

4.6 No cookies on redirect/QR domains. The redirect service returns only a 302 redirect or a cached landing page and sets no cookies on Kilo redirect or QR domains. Slug responses are marked noindex, nofollow.

4.7 Query parameters. Incoming query parameters (such as UTM tags) may be forwarded onto the resolved Destination so the Destination receives the campaign context; the Destination's own parameters take precedence.

5. How We Handle IP Addresses (Explained)

In short. We take your IP address only for a split second to compute a one-way, salted hash, then discard it. The salt (a secret "pepper") rotates, and the hash is bucketed per day and truncated. The result cannot be reversed back to your IP and is not tied to your identity. So: we never store raw IP addresses anywhere.

5.1 To count and de-duplicate scans/clicks without tracking individuals, we compute a fingerprint by hashing, with SHA-256, a combination of: a secret rotating value (a "pepper"), the current UTC day, the visitor's IP address, and the user-agent string. We keep only the first 16 hexadecimal characters (64 bits) of that hash. The raw IP address is used only in-memory to compute this value and is then discarded; it is never written to logs, databases, key-value storage, or our analytics store.

5.2 Because the pepper is secret and rotates, and the hash is bucketed by UTC day and truncated, the fingerprint cannot be reversed to recover the IP address, limits correlation across days, and loses continuity whenever the pepper rotates. We conclude that the fingerprint, as stored, is not a raw IP address and is designed to minimize identifiability. Depending on jurisdiction, such a hash may still be treated as personal data; we handle it accordingly.

5.3 In a few operational contexts (Turnstile bot-checks, support tickets, and abuse reports), an IP address is transiently used to verify a request and is passed to the relevant sub-processor for that verification purpose only. For analytics, approximate geography (country, region, city) is derived at our edge infrastructure (Cloudflare) from the connecting IP address, and only those coarse geographic labels are attached to analytics events - the IP address itself is never sent to or stored by our analytics provider (our proxies strip client-IP headers before forwarding analytics traffic). Where we store an IP-derived value for support or abuse records, we store only a peppered hash, never the raw IP.

6. Cookies and Similar Technologies (Cookie Notice)

In short. Redirect and QR domains: no cookies, ever. Marketing sites: cookieless analytics, so no banner needed. The signed-in dashboard: yes - a login cookie you cannot opt out of without losing the ability to log in, plus product analytics including masked session replay. We do not present a consent banner on the dashboard today; if you would rather we did not keep that data about your account, email [email protected] and we will delete it.

6.1 Redirect / QR / link domains. We set no cookies on these domains.

6.2 Marketing sites (our public informational sites). We use cookieless analytics that keep no persistent identifier in your browser and do not set analytics or marketing cookies. Because these sites are cookieless, no cookie-consent banner is presented on them.

6.3 Signed-in dashboard. When you are signed in, we use:

• (a) a strictly necessary authentication cookie (qr2r_session, HttpOnly, Secure) to keep you logged in; and
• (b) analytics/product-improvement technology (PostHog, EU region), including identified product analytics and session replay in which text inputs and passwords are masked, and which is disabled on our admin pages. Sensitive fields (such as API tokens, recovery codes, and member/invite emails) are excluded from capture.

6.4 Cookie categories and your choices. Where cookies or similar technologies are used, they fall into these categories: Strictly Necessary (authentication, security), Functional (preferences), and Analytics (product improvement). We do not use advertising/marketing cookies. We do not currently present a consent banner or a preference centre on the signed-in dashboard: the authentication cookie is strictly necessary, and the analytics described in 6.3 run for product improvement. You may ask us at any time to delete the product-analytics data and session replays associated with your account by emailing [email protected], and we will do so without affecting your ability to use the Services. If we later add a consent mechanism, this section will describe how to manage preferences.

6.5 Third-party CDN note. Our dashboard currently loads a web font from a third-party font CDN, which means your browser may contact that provider when you load the dashboard. See Section 8. We intend to self-host this font so the request stops leaving our own infrastructure.

6.6 Do Not Track. We do not currently respond to browser "Do Not Track" signals in a standardized way.

7. How and Why We Use Personal Data (Purposes and Legal Bases)

In short. We use data to run the Services, keep them safe, bill you, support you, and improve the product. Under GDPR, our legal bases are contract, legitimate interests, consent (where required), and legal obligation.

7.1 We process personal data for the following purposes, relying on the indicated legal bases (where GDPR/UK GDPR applies):

• (a) Provide the Services - create and resolve Links/QR Codes, host content, and deliver analytics. Basis: performance of a contract; for click/scan data, the Customer's chosen basis.
• (b) Security, safety, and abuse prevention - authentication, fraud/abuse detection, safety scanning of Destinations, and traffic classification. Basis: legitimate interests; legal obligation.
• (c) Billing and account administration. Basis: contract; legal obligation.
• (d) Support and communication - respond to tickets, send transactional emails. Basis: contract; legitimate interests.
• (e) Product analytics and improvement - understand and improve how account holders use the dashboard. Basis: legitimate interests; consent where required.
• (f) Marketing-site analytics - cookieless measurement. Basis: legitimate interests.
• (g) Legal compliance and enforcement - comply with law, respond to legal process, and enforce our Terms and AUP. Basis: legal obligation; legitimate interests.

7.2 We do not use Customer Content or End-User data to train generative or machine-learning models by default (see Terms Section 6.7).

8. Sub-Processors and Third-Party Providers

In short. We rely on a short list of vetted providers to run Kilo. The living list is below. Our billing runs through "merchants of record," so your card never touches Kilo. We'll give notice before adding a new sub-processor that handles personal data, and you can object.

8.1 Living list. The table below is the current list of sub-processors and key third-party providers that may process personal data on our behalf or in connection with the Services. We will keep it current and, per Section 8.3, provide notice of material additions.

8.2 Merchants of record. Polar and Creem act as merchants of record for purchases. Creem is operated by Armitage Labs OÜ (Telliskivi 57b/1, 10412 Tallinn, Estonia), which also provides the care-of correspondence address shown for Kilo Routes in these documents - a merchant-of-record care-of address, not Kilo Routes' own registered office. They (and their payment processors) collect and process payment-instrument data directly; Kilo does not receive or store card data.

8.3 Change notice and objection. When we intend to add or replace a sub-processor that processes personal data, we will update this list and, for Customers, provide reasonable advance notice (for example by email or in-product notice). If you have a signed Data Processing Addendum, its notice-and-objection mechanics govern; otherwise, you may object on reasonable data-protection grounds by contacting [email protected], and if we cannot reasonably accommodate the objection, your remedy is to stop using the affected part of the Services.

9. Where Data Is Stored; International Transfers

In short. Data runs on Cloudflare's global edge and other providers that may operate outside your country. Where required, we rely on recognized transfer safeguards like Standard Contractual Clauses.

9.1 The Services run on Cloudflare's global edge network and other providers listed in Section 8, which may process data in countries other than yours, including outside the EEA/UK. Account data is stored in Cloudflare D1; files and raw inbound email are stored in Cloudflare R2.

9.2 Where personal data is transferred internationally from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or a provider's certification under an applicable data-transfer framework, as available. For a copy of the relevant safeguards, contact [email protected].

10. Retention

In short. We keep data only as long as we need it. Click analytics live about 90 days; audit logs about a year; anonymous file uploads 7 days. Some retention numbers are operator-configurable, so treat them as typical, not fixed.

10.1 We retain personal data for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Typical retention:

• (a) Click/scan analytics - retained approximately 90 days in our analytics store; per-plan analytics visibility windows (which control how far back a Customer can view) range from 1 to 365 days and are a display limit, not a separate deletion schedule.
• (b) Account and Organization data - retained for the life of the Account and for a reasonable period afterward, subject to legal retention needs.
• (c) Audit logs - retained approximately 1 year.
• (d) Anonymous file/PDF uploads - retained 7 days, then deleted. Signed-in uploads - retained until you request deletion or your Account is closed.
• (e) Email logs and support/abuse records - retained for a reasonable period for operational, security, and legal purposes.
• (f) Deleted Links - recoverable from trash for approximately 30 days, then permanently deleted; a deleted Link's Slug remains reserved for the cooldown period described in the Terms of Service.

10.2 Several retention values are operator-configurable and are stated as typical current practice, not fixed guarantees. Backups may persist for a limited additional period.

11. Your Privacy Rights and How to Exercise Them

In short. Depending on where you live, you can ask to access, correct, delete, or port your data, or object to certain processing. Kilo has no self-serve "delete my account" or "download my data" button today - send your request by email to [email protected] and we'll handle it manually. End Users should generally contact the Customer behind the specific Link.

11.1 Rights. Subject to applicable law (including GDPR/UK GDPR and CCPA/CPRA), you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You will not be discriminated against for exercising these rights.

11.2 How to exercise. Because the Services do not currently provide in-product account-deletion, data-erasure, or data-export tools, please submit rights requests by email to [email protected]. We will verify your request and respond within the period required by applicable law. We will not promise in-product self-service tools that do not exist; requests are fulfilled through a manual process.

11.3 End Users. For data collected by a specific Link/QR Code (where a Customer is the controller), please direct your request to the Customer that owns the Link. If you contact us, we will forward or assist as appropriate.

11.4 Complaints. If you are in the EEA/UK, you may lodge a complaint with your local supervisory authority. We ask that you contact us first so we can try to resolve your concern.

12. California Privacy (CCPA/CPRA)

In short. We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising for money. We use only the categories of data described above, for the business purposes described above.

12.1 We do not sell personal information, and we do not share personal information for cross-context behavioral advertising in exchange for money. The categories of personal information we collect, the purposes, and the sources are described in Sections 3–7. We disclose personal information to sub-processors (Section 8) only to provide the Services. California residents may exercise the rights in Section 11 by contacting [email protected].

13. Security

In short. We use industry-standard protections: hashed credentials, passkey/2FA options, encrypted transport, admin allowlisting, and secret rotation. No system is perfectly secure.

13.1 We maintain administrative, technical, and organizational measures designed to protect personal data, including: storing credentials as hashes (API keys, recovery codes, email-change codes); passkey/WebAuthn multi-factor authentication with optional enforcement; short-lived signed session tokens with live suspension checks; bot challenges on sign-in; allowlist-gated administrative access; and periodic rotation of secrets (including the IP-hashing pepper and session-signing secret). Despite these measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children

In short. Kilo is for adults. You must be at least 18.

14.1 The Services are not directed to, and may not be used by, anyone under 18 years old, stated identically in our Terms of Service. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us personal data, contact [email protected] and we will delete it.

15. Changes to This Policy

In short. We may update this policy; material changes get notice.

15.1 We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide reasonable notice (for example by email or in-product notice) as described in the Terms.

16. Contact; Controller Identity; EU/UK Representative

In short. Here's how to reach us about privacy.

16.1 The controller of account-holder personal data is Kilo Routes (the operator identified in our Terms of Service), c/o Creem (Armitage Labs OÜ, our merchant of record), Telliskivi 57b/1, 10412 Tallinn, Estonia - a merchant-of-record care-of address, not a registered office. Privacy contact: [email protected]. We have not appointed a Data Protection Officer; privacy questions go to [email protected]. We have not appointed an EU/UK representative under Article 27 GDPR at this time.

16.2 For trust information about a specific Link, see /verify. To report abuse, see /abuse.

This Privacy Policy is incorporated into the Terms of Service and should be read together with the Acceptable Use Policy.